EUVD-2026-104635
GHSA-5xm2-6676-qcp9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessUpload crafted APNG to image-processing endpoint
-
ExploitPillow calls Image.open() positioning frame zero
-
ExecutionFull-canvas background allocated before bomb check
-
ImpactMemory exhausted, service denial
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory allocation limits
|
| Exploitation Conditions | Triggered when an application calls Image.open() on an attacker-controlled APNG file crafted with a small first frame, a very large declared canvas size, and either background disposal or a first-frame OP_PREVIOUS disposal method; these cause PngImageFile._seek to allocate the full-canvas background buffer before the decompression-bomb check. No pixel loading, frame iteration, authentication, or user interaction is required (PR:N/UI:N), and default configurations of Pillow 8.1.0 through 12.x are vulnerable. The practical limiting factor is that the target must actually parse untrusted image input with Pillow and must be running a pre-13.0.0 version; raising Image.MAX_IMAGE_PIXELS would not help since the allocation precedes the check. |
| Impact | All signals point to a genuine but bounded denial-of-service risk rather than a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote, unauthenticated, low-complexity reachability with no user interaction, and the impact is isolated to availability (VC:N/VI:N/VA:H) - there is no confidentiality or integrity loss, so the 8.7 (High) score is driven entirely by memory-exhaustion DoS. This is corroborated by CWE-789 (Memory Allocation with Excessive Size Value) and the description, which agree the allocation is sized from an attacker-declared canvas dimension. No EPSS score, SSVC decision, KEV listing, or POC flag was provided in the input; the referenced GitHub commit is the vendor fix and ships trigger test cases (DecompressionBombError assertions), but that is remediation code, not a weaponized public exploit. Net: a real, easy-to-reach DoS worth prompt patching for any service that ingests untrusted images, but not a remote-code-execution or data-breach priority. Note one nuance to verify: the input Tags label this 'Information Disclosure,' which directly contradicts the CVSS (VC:N) and the description - this is an availability bug, not disclosure. |
| Exploit ScenarioDerived | An attacker uploads a crafted APNG to any web service that processes user-supplied images with Pillow (e.g. avatar/thumbnail handling). The file declares a tiny first frame but a very large canvas with background disposal or OP_PREVIOUS, so the moment the server calls Image.open() the full-canvas background buffer is allocated before the decompression-bomb check runs, exhausting memory and crashing or hanging the worker. The vendor fix commit includes test cases that reproduce the DecompressionBombError trigger, but no independent public exploit was indicated in the input. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 19, 2026
Memory exhaustion in Pillow 8.1.0 through 12.x allows unauthenticated remote attackers to cause denial of service by supplying a crafted APNG that triggers a full-canvas background allocation inside Image.open() before the decompression-bomb check. The flaw is reachable when an application parses untrusted images with an affected version; no pixel loading, frame iteration, authentication, or user interaction is required. No public exploit code or CISA KEV entry was identified at time of analysis, but the availability impact is high (CVSS 8.7; assessed CVSS:3.1 A:H).
RemediationAI
Upgrade to Pillow 13.0.0, which contains the fix; see the vendor advisory https://github.com/python-pillow/Pillow/security/advisories/GHSA-5xm2-6676-qcp9, the fix commit https://github.com/python-pillow/Pillow/commit/f1acfc54c53502948d0d14121872061df931db48, and the release notes https://github.com/python-pillow/Pillow/releases/tag/13.0.0. If immediate upgrade is not possible, do not pass untrusted APNG or image files to Image.open(); validate declared canvas dimensions with a separate hardened parser or reject APNGs until patched, and run image parsing in a memory-limited, isolated worker or sandbox to cap the impact of a large allocation. These compensating controls have trade-offs: rejecting APNGs breaks animated PNG support, and strict memory limits may fail legitimate large images, while raising Image.MAX_IMAGE_PIXELS does not address this issue because the allocation occurs before the check.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Pillow's APNG handling in PngImageFile._seek allocates the disposal background at the declared full canvas size when processing background disposal or a first-frame OP_PREVIOUS disposal. A crafted APNG can declare a very large canvas while keeping the first frame small, and because this allocation happens while Image.open() positions frame zero, the decompression-bomb guard is reached too late. This is CWE-789 (memory allocation with excessive size value), affecting Pillow 8.1.0 through pre-13.0.0 per the python-pillow:pillow CPE. The referenced fix commit f1acfc54 adds decompression-bomb checks in seek paths and includes tests for DCX, MIC, and MPO plugins, illustrating the same late-check class; the release containing the fix is 13.0.0. No public exploit code was identified at time of analysis.
Know when Pillow gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Remote unauthenticated parsing of an untrusted image with no interaction (AV:N/AC:L/PR:N/UI:N); impact is memory-exhaustion DoS only, so A:H with C:N/I:N.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow can allocate an APNG disposal background at the full canvas size before applying the decompression-bomb check. A crafted APNG with a small first frame, a very large declared canvas, and background disposal or first-frame OP_PREVIOUS reaches PngImageFile._seek while Image.open() positions frame zero. The full-canvas allocation occurs inside Image.open() without requiring pixel loading or frame iteration. This can exhaust memory and deny service. This issue is fixed in version 13.0.0.
Blast Radius
ecosystem impact- 78 pypi packages depend on pillow (66 direct, 12 indirect)
Ecosystem-wide dependent count for version 8.1.0.
Technical POC Analysis
The bug class is CWE-789, Memory Allocation with Excessive Size Value (an allocation sized from an unvalidated file-declared number, on a code path the library's own allocation guard does not yet cov…
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Pillow versions 8.1.0 through 12.x expose organizations to high-severity availability risk when applications process untrusted image files, because a specially crafted image can exhaust server memory and disrupt service before normal safeguards engage. Leadership should care because affected image-processing workloads, especially internet-facing upload and content pipelines, can become unavailable remotely and impact dependent business services; no public exploit was identified at time of analysis, and no vendor-released patch was identified at time of analysis.
No vendor-released patch identified at time of analysis; interim mitigations include blocking or rejecting APNG inputs where not required, enforcing strict upload size and image-dimension limits, running image parsing in sandboxed low-privilege workers with memory and CPU quotas and timeouts, isolating internet-facing image-processing services, and monitoring for memory exhaustion or worker crashes.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
libImaging/TgaRleDecode.c in Pillow 9.1.0 has a heap buffer overflow in the processing of invalid TGA image files. Rated
Denial of service in Python Pillow (versions 8.2.0 through 12.2.0) allows remote attackers to exhaust memory during JPEG
Out-of-bounds memory disclosure in Python Pillow before 12.3.0 lets an attacker who supplies a crafted McIdas AREA image
Heap out-of-bounds write in Python Pillow prior to 12.3.0 lets an attacker who controls the rank-filter size parameter c
Uncontrolled memory consumption in Python Pillow (PIL) versions 5.1.0 through 12.2.x allows a remote attacker to cause d
The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb
Pillow is a Python imaging library. In versions 11.2.0 to before 11.3.0, there is a heap buffer overflow when writing a
Integer overflow in the ImagingResampleHorizontal function in libImaging/Resample.c in Pillow before 3.1.1 allows remote
Python Image Library (PIL) 1.1.7 and earlier and Pillow 2.3 might allow remote attackers to execute arbitrary commands v
Pillow versions 11.0.0 through 12.x (fixed in 13.0.0) can reuse a stale native ImagingCore buffer when a multi-frame ima
Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass controlled parameters
An issue was discovered in Pillow before 8.1.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely explo
Exploit-DB